A flight plan is the detailed description of the route to be followed by an aircraft within the framework of a planned flight. The flight plan is customarily managed aboard civil aeroplanes by a system designated by the terminology of “Flight Management System”, which will subsequently be called the FMS, which places the route to be followed at the disposal of the flight personnel and at the disposal of the other onboard systems. This FMS system also allows an aid to navigation, through the display of information useful to the pilots, or else through the communication of guidance orders to an automatic piloting system.
FIG. 1 presents a summary diagram illustrating the structure of an FMSO known from the prior art. A known FMS type system has a man-machine interface MMI comprising for example a keyboard and a display screen, or else simply a touch display screen, as well as at least the following functions, illustrated in a generic manner by an associated module and described in the ARINC 702 standard:                Navigation LOC performs the optimal location of the aircraft as a function of the geo-location means GEOLOC such as satellite or GPS based geo-positioning, VHF radionavigation beacons, inertial platforms. This module communicates with the aforementioned geo-location devices. Thus the module LOC calculates the position (latitude, longitude, altitude) and the speed of the aircraft in space.        Flight plan FPLN inputs the geographical elements constituting the skeleton of the route to be followed, such as the points imposed by the departure and arrival procedures, the waypoints, the aerial routes or “airways”;        Navigation database NAVDB contains the waypoints, the geographical routes, the procedures and the beacons;        Performance database PERFDB contains the craft's aerodynamic performance and engine parameters;        Lateral trajectory TRAJ, constructs by calculation a continuous trajectory on the basis of the points of the flight plan, using the performance of the aircraft and while complying with the confinement constraints (RNP);        Predictions PRED, constructs an optimized vertical profile on the lateral trajectory and provides the predictions in terms of transit time, quantity of fuel remaining, altitude and speed of transit at each of the points of the flight plan;        Guidance GUID establishes, on the basis of the position and of the calculated trajectory, guidance orders to guide the aircraft in the lateral, vertical planes and speed so as to follow its three-dimensional trajectory, while optimizing its speed. The guidance orders are transmitted to the automatic pilot. When the aircraft is equipped with an automatic pilot PA and it is operating, it is the latter which transforms the guidance orders into flight controls;        DATALINK digital data link communicates with the air traffic control centres, the ground operational centres and, in the future, other aircraft 13.        
The flight plan is entered by the pilot, or else by data link, on the basis of data contained in the navigation database.
The pilot thereafter inputs the parameters of the aircraft: mass, flight plan, span of cruising levels, as well as one or a plurality of optimization criteria, such as the Cost Index CI. These inputs allow the modules TRAJ and PRED to calculate respectively the lateral trajectory and the vertical profile, that is to say the flight profile in terms of altitude and speed, which for example minimizes the optimization criterion.
Thus in a conventional manner a flight management system:
calculates a position of the aeroplane (LOC) on the basis of data arising from onboard sensors listed hereinabove,
determines a trajectory (module TRAJ/PRED) with the databases PERF DB, in accordance with the flight plan defined on the basis of the NAV DB,
provides, on the basis of the position and of the trajectory, guidance orders (module GUID), (“flight guidance target”) so as to follow this trajectory. In a conventional manner, the calculated aeroplane position makes it possible to identify a possible disparity with the trajectory or a forthcoming change (turn, climb, acceleration, deceleration) of the trajectory. On the basis of this lateral disparity, GUID will establish a guidance order, in a conventional manner: roll laterally, pitch or slope vertically, speed or thrust level in terms of speed.
Hereinafter in the disclosure, the term “guidance order” (or “flight guidance target”) covers all the guidance orders such as defined hereinabove.
The guidance orders generated by GUID are transmitted to the automatic pilot PA. The PA transforms the guidance orders which are dispatched to it into flight controls directly applied to the aircraft (Ailerons, Elevators, Engines etc.)
Hereinafter in the disclosure, the term “flight control” covers all the flight controls such as defined hereinabove.
In a conventional manner, the automatic pilot generates and dispatches to the control surfaces of the aeroplane the position (angle) for the ailerons and elevators, the thrust for the engines etc.
Generally, an automatic pilot PA makes it possible to guide an aircraft automatically on the basis of directives provided, either by the pilot (“tactical”) through an interface termed FCU (AIRBUS) or MCP (BOEING), or by a system of FMS type (strategic). We shall be interested in guidance on the basis of the FMS.
These flight controls are presented to the pilot via the flight director in the form for example of vertical and lateral bars (that the pilot must try to follow by hand when the automatic pilot is not engaged).
Certain procedures require a more significant level of precision in aircraft guidance. For example, towards the end of the cruising phase and a few minutes before beginning the descent, the pilot selects via the FMS the approach procedure that he will use to place the aeroplane on the landing runway of his destination airport. The approach procedure for certain airports is of the RNP AR type with RNP<0.3 NM.
The RNP concept used in the aeronautical industry consists on the one hand in the capability of the aeroplane's navigation system to monitor its performance (precision) and to inform the pilot of compliance or otherwise with the operational requirements (error) during the operation, and on the other hand in the optimization of the approach procedures by basing them on the navigation performance of the aeroplane.
This concept makes it possible to reduce the spacings between aeroplanes when cruising and in the terminal zone, to optimize the takeoff and landing procedures. It also makes it possible to reduce the minima associated with the approach procedures both in non-precision approaches and in RNAV conventional approaches.
An RNP procedure refers to a specific procedure or block of space. For example, an RNP xx procedure signifies that the aircraft's navigation systems must be capable of calculating the position of the aircraft in a circle of xx Nm, for example an RNP 0.3 in a circle of 0.3 Nm.
The RNP AR concept for its part makes it possible to add several capabilities:
access without specific ground means to fields that are difficult to access because of the relief (for example Juneau, Queenstown)
reconcile the trajectories of procedures of parallel approach on airports (gain 1 RNP between two procedures (for example San Francisco)
construct shorter procedures which therefore consume less fuel (for example Doha)
construct procedures which reduce sound nuisance (for example Washington, arrival over the Potomac)
reduce the dispersion of the approach trajectories (vs ATC)
replace approaches requiring ground means by virtue of a reduction in the lateral uncertainty and a monitoring of the vertical disparity with the reference profile (the FAA has twinned CAT I approaches with RNP procedures, often AR).
The notion AR (“Authorization required”), involves an obligation to obtain, on a case by case basis, authorization by the local authorities to operate the approach in question with the defined minima. This authorization is delivered to each crew on a given aeroplane type and for each approach.
For these specific approaches, such as RNP AR approaches, it is appropriate to implement an avionics architecture which makes it possible to comply in an automatic manner with the integrity and continuity constraints associated with this type of approach.
Continuity, or availability, is intended to mean the fact that when a fault with the FMS system or with the associated guidance system (automatic pilot) is detected, the aircraft is capable of switching over to another system affording the same level of service. Conventionally, availability is obtained by splitting the FMS and the associated automatic pilot, such as illustrated in FIG. 2. The two chains FMS10/PA10 and FMS20/PA20 are autonomous, that is to say independent of one another. The FMS10 calculates a position, a trajectory and the module GUID10 generates a guidance order CG10 such as described previously. The guidance order CG1 is dispatched to the automatic pilot PA10. Likewise the FMS20 calculates a position, a trajectory and a module GUID20 generates a guidance order CG20 such as described previously. The guidance order CG10 is dispatched to the automatic pilot PA10 and the guidance order CG20 is dispatched to the automatic pilot PA20.
When a fault is detected in the system FMS10+PA10, the overall system switches over to the system FMS20+PA20, either automatically, or through an action of the pilot.
In order to carry out approaches of “autoland” type in which the automatic pilot is capable of landing the aeroplane, certain automatic pilots exhibit a so-called COM/MON architecture. The COM (for “command”) part of the automatic pilot establishes a directive CV10 with the aid of the piloting laws.
In a conventional manner, the automatic pilot determines the disparity between the current attitude (roll, pitch) of the aeroplane and the desired directive (pilot selection or FM guidance command) and generates on the basis of a piloting law a flight control CV10. Moreover, the COM part of the automatic pilot transmits the desired directive to the MON (for “monitoring”) part, which implements in the same manner as COM the same piloting law to generate a flight control CV1 bis. The integrity of the flight control CV10 is verified by comparison with CV1 bis. The COM part of the automatic pilot PA has transmitted its command CV10 to the MON part of the PA and the MON part of the PA has transmitted its command CV1 bis to the COM part of the PA. PA COM and MON compare their respective commands and invalidate the PA if a representative disparity is measured.
Each automatic pilot uses a unique guidance order arising from the corresponding FMS.
Concerning the problematic issue of the integrity of the system for these specific approaches, for example to be able to follow an RNP xx procedure, the aircraft's navigation system must be capable of calculating the position of the aircraft in a circle of xx Nm, but the automatic piloting system must also guarantee that it will be able to guide the aircraft with the same precision.
The precision level of the guidance is fixed and known, whereas the precision of the calculation of the position can vary along the flight (different GPS coverage, drifts of the inertial platforms, more or less dense coverage of the radio navigation means).
In a conventional manner, the error in calculating the aeroplane position called TSE (Total System Error) represented in FIG. 3 is the quadratic sum of 3 components:
The aeroplane location error or PEE for “Position Estimation Error”,
The aeroplane trajectory error or PDE for “Path Definition Error”,
The aeroplane guidance error or PSE for “Path steering Error”.
The arrow DesP corresponds to the desired trajectory (“desired path”), the dotted arrow DefP (“defined path”) corresponds to the calculated trajectory.
The flight management system FMS contributes to the three components of the TSE, as illustrated in FIG. 4.
The term “outer loop” (or “large loop”) corresponds to the servocontrol laws managing the displacement of the centre of gravity of the aeroplane (high-level directive as input such as heading, altitude, etc. and low-level directive as output roll, pitch). The term “inner loop” (or “small loop”) designates the servocontrol laws managing the equilibrium of the aeroplane around the centre of gravity (low-level directive such as roll, pitch as input, flight controls as outputs such as the angles in regard to the control surfaces). PFD signifies Primary Flight Display, where the Flight Director directives are displayed.
Now, it is the components (Position, Trajectory and guidance) of this TSE which are one of the sources of error leading to a potentially undetected erroneous calculation of a lateral or vertical guidance.
The demand for more significant integrity of the TSE appears for so-called RNP AR approaches with RNP<0.3 NM. To aid compliance with this integrity, a strong constraint has appeared in regard to the definition of the trajectory which must be “geo” referenced laterally and vertically, stated otherwise the straight and curved segments for the lateral and the slopes for the vertical are fixed with respect to the ground and all the aeroplanes will follow exactly the same trajectory. It emerges therefrom that for FMSs using a good representation of the “earth” (WGS84 compatible), the error related to the construction of the trajectory can be ignored in the formula for the TSE.
It is therefore appropriate for the FMS system to ensure the required integrity by detecting the calculation errors in regard to position and to guidance. The current facilities supporting the FMS application do not guarantee an occurrence per flight hour of non-detection of erroneous calculation of less than a few 10−6, typically 5.10−6.
Now, for approaches of RNP type with RNP<0.3 NM for example, an integrity level called “hazardous”, corresponding to a fault occurrence of less than 10−7 per flight hour, is required. A lone FMS may not therefore ensure an integrity of this level. Duplication of the FMS used for obtaining continuity does not solve this problem, each FMS being individually limited in integrity.
A first solution of the prior art to attain the “hazardous” level of integrity is described in document U.S. Pat. No. 8,660,745. The architecture of the system comprises two FMSs, a “master” FMS carrying out the “computing” and a second “slave” FMS carrying out the “monitoring”. The commands emitted by the master are verified by the slave: If the slave FMS estimates not being in the conditions (sequencing of the point of the flight plan aimed at to pass to the following point), it rejects the guidance order causing the transition to independent. The 2 FMSs are no longer in DUAL mode and operate without exchanging information. Thus the crew knows that the RNP manoeuvre poses a problem, but the difficulty is to know which FMS is valid and which FMS is defective. This architecture makes it possible to maintain the proper level of integrity since the guidance error is detected but does not comply with the continuity requirement since the pilot cannot continue the operation, since even if he succeeds in detecting the “good” FMS, the integrity level required is not achieved with a lone FM.
A second solution of the prior art to attain the “hazardous” level of integrity is described in document US20120092193 and in FIG. 5. This architecture called “Triplex” implements 3 FMSs and two automatic pilots. The principle is that each of the three FMSs, FMS1, FMS2 and FMS3, is capable of generating a guidance order independently.
On the basis of these three guidance order values, a vote is carried out in the first automatic pilot PA1, that is to say that a middle value is calculated, and if a value is too far from the middle value, then it is discarded and the corresponding FMS is invalidated. When an FMS is discarded, there still remain two FMSs which can be compared, guaranteeing the availability and the integrity level required. Thus this architecture makes it possible, in case of a fault with a first FMS, to continue to guide the aeroplane (availability) along the trajectory with the same integrity level (“hazardous”), during approach procedure of RNP xx type.
A drawback of this architecture is that it is expensive to develop, since the vote is complex to fine tune and requires a significant modification of the automatic pilot. Moreover, a great deal of aircraft are equipped only with 2 FMSs and do not have the capability to add a 3rd instance at the very least at lesser cost. On the other hand they may wish to access airports with approaches of RNP AR type with RNP<0.3 NM.
An aim of the invention is to alleviate the aforementioned drawbacks, by proposing an avionics architecture (and a method) which is simplified, compatible with a system with 2 FMSs and capable of guiding an aircraft automatically while guaranteeing a high integrity level, and if appropriate while also guaranteeing continuity.